When organisations talk about risk, they usually focus on the visible and technical. Cyber security. Compliance. Financial controls. System resilience. These are all important, and all budgeted for.
What is rarely treated as a risk is the absence of capacity. And yet, lack of capacity is one of the biggest drivers of failure, stress, and instability in day-to-day operations.
How risk is usually misunderstood
Most organisations plan for the expected.
Workloads are based on averages. Timelines assume things go broadly to plan. Staffing models are built around steady demand. When disruption happens, it is treated as an unfortunate deviation rather than something that should have been anticipated.
But real work does not behave like an average.
People get ill. Systems fail. Requirements change. Data arrives late or incomplete. Priorities shift. None of this is unusual, yet most teams are resourced as if it is. When there is no spare capacity, even small disruptions create outsized impact.
Firefighting is a risk signal
Firefighting is often framed as a performance issue or a cultural one. In reality, it is a risk signal.
It tells you that the system has no slack. That it relies on everything going right. That resilience exists only in people’s willingness to stretch themselves further.
A system that depends on heroics is not robust. It is fragile, and it will eventually fail at the worst possible moment.
Capacity absorbs shock
Extra capacity is what allows organisations to absorb shocks without crisis.
It creates space to respond to the unexpected without dropping everything else. It allows teams to investigate issues properly rather than patching them. It enables learning, not just recovery.
This is not about having people idle. It is about having margin.
In safety-critical industries, this principle is well understood. Redundancy is designed in. Buffers are normal. Safety margins are non-negotiable. No one argues that these are wasteful.
Knowledge work should be no different.
The cost of pretending capacity is optional
When capacity is treated as optional, the cost does not disappear. It is simply relocated.
• Stress and burnout replace formal risk controls
• Rework replaces planned improvement
• Individual memory replaces documented process
• Crisis response replaces thoughtful decision-making
None of these are cheaper. They are just harder to account for.
Reframing the conversation
The question is not whether organisations can afford extra capacity.
The question is whether they can afford to operate without it.
If firefighting is constant, the system is already operating beyond safe limits. Extra capacity is not indulgence. It is basic risk mitigation.
In the next article, I will look at why running permanently lean is often described as efficiency, and why this framing creates a false economy that ultimately costs more, not less.